KR19990078937A - User authenticate system using a second channel - Google Patents

Abstract

The user authentication system using the second access path is to prevent hacking of user information and illegal user authentication from hackers with high hacking ability in services such as electronic commerce, internet stock trading, and phone banking. A user authentication system for achieving this object, in a user authentication system having a first connection path with a user, processes the user's request through the first connection path within a predetermined range, and the predetermined range When the departure processing is required, the user authentication is performed using the second connection path. In addition, the above-described second connection path is preferably implemented by a telephone communication network and a communication system thereof. In addition, when the existing authentication method and the authentication method according to the present invention are organically combined, the authentication through the existing first access path is primarily performed to allow simple access to the system in order to handle user requests within a predetermined range. The authentication and the authentication through the second connection path according to the present invention are preferably applied to the final user authentication to allow access or update of important information outside the above-mentioned predetermined range. As a result, the user authentication system according to the present invention provides a significantly improved security effect and reliability compared to the existing, thereby allowing the user to make credit transactions with confidence in the use of an e-commerce service using a communication network, It further provides the effect of promoting related industrial development.

Description

User authenticated system using a second access path

The present invention relates to a user authentication system using a second connection path, and in particular, an existing user by performing a final user authentication through a second connection path (telephone communication network) different from the first path where the user connects to the system. The present invention relates to a user authentication system whose reliability and stability are superior to that of an authentication system.

In general, the user authentication system receives an ID and a password for accessing a specific service system from a user through a single access path, and compares it with those of a corresponding user previously stored in the system. User authentication is performed. Further, in order to prevent hacking of personal credit information or transmission data on the access path, data (ID, password, or contents) transmitted between the user terminal and the service providing system may be further encrypted and decrypted using a predetermined encryption algorithm ( Or scrambling and descrambling).

Meanwhile, with the rapid development and dissemination of the Internet, e-commerce, home banking, and telecommuting are increasing, and the related information industry is developing. In this information industry, various security systems and user authentication systems have been developed to prevent leakage and damage of personal credit information and important information from hackers with highly specialized hacking capabilities. Among them, the password encryption system has fundamental technical limitations, and despite the development of security systems (firewalls, etc.), it is incapable of advanced hacker hacking techniques.

In particular, if hackers with advanced hacking techniques intercept the transmission data (ID, password) on the connection path and decrypt it, the service providing system provides user authentication to an unjust user despite the existence of a perfect firewall. There is no choice but to do it. Therefore, the technical limitations of the existing user authentication system and the advanced hacking techniques and the increasing risk of hacking are provoking a vague anxiety for general users' use of e-commerce services, which is a great obstacle to the development of related industries. It is becoming.

An object of the present invention for solving the above problems, in the user authentication system, to prevent the interception of the user information for authentication by the hacker on the general access path, even in such a case, only distinguishing the right user with certainty By providing a user authentication system, the reliability and stability are significantly improved.

1 is a block diagram showing a user authentication system using a second connection path according to an embodiment of the present invention,

FIG. 2 is a flowchart illustrating a preferred user authentication method of the user authentication system using the second connection path shown in FIG. 1.

<Description of the symbols for the main parts of the drawings>

10: user interface means 11: the first user terminal

12: second user terminal 20: service provider system

21: User authentication and service provision means 22: Existing authentication DB

23: DB for telephone authentication 30: communication connection and management system

31: Communication connection system (ARS) 32: Connection management system

40: RESOURCE

A user authentication system of the present invention for achieving the above object, in a user authentication system having a first connection path with a user, processing the user's request through the first connection path within a predetermined range, The technical feature is that the user authentication is performed using the second connection path when processing outside the preset range is required. In addition, the above-described second connection path is preferably implemented by a telephone communication network and a communication system thereof.

In addition, when the existing authentication method and the authentication method according to the present invention are organically combined, authentication through the existing first access path is a primary authentication that allows access to the system to handle user requests within a predetermined range. In addition, the authentication through the second connection path proposed according to the present invention is preferably applied to the final user authentication to allow access or update to important information outside the above-described predetermined range. The primary and secondary authentication schemes in this case are clearly different in their technical configuration and effect from the simple dual authentication scheme for authenticating a user twice through the same connection path, which is obvious to those skilled in the art.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 shows a user authentication system using a second access path according to an embodiment of the present invention. In particular, the user authentication system shown in FIG. 1 is a preferred implementation in the case where the existing primary authentication method using the first connection path is organically combined with the secondary authentication method using the second connection path (specifically, a telephone communication network). An example is shown and this invention is not limited to this.

The main configuration of FIG. 1 includes a user interface means 10 having two user terminals 11 and 12 individually connected to different connection paths, and a request from a user through the first connection path within a predetermined range. Service provider system 20, and user interface means 10 and service provider that perform user authentication and provide services according to the second access path when processing is performed out of the predetermined range. Located on the second connection path between the systems 20, if the end user authentication is required, call the second user terminal 12 connected to the user's phone number to request the user authentication information and the user authentication that is responded therefrom. It consists of a communication connection and management system 30 for delivering information to the service provider system 20. When the user authentication is finally performed by the user authentication and service providing means 21, the resource RESOURCE 40 indicates a resource object that requires a legitimate user's access or updates of the information. . Here, resource objects requiring final user authentication correspond to all objects requiring user-specific authentication procedures such as general data files, DB tables, bank accounts, and directory services.

Specifically, the first user terminal 11 of the user interface means 10 is connected to the service provider system 20 through the first connection path, and is a user interface for the user to request and receive a predetermined service. The second user terminal 12 is connected to the service provider system 20 through the second connection path and the communication connection and management system 30, and the request of the service provider system 20 and the communication connection and management system 30. By means of the user interface means for inputting the final user authentication information into the aforementioned systems. Here, each access path is implemented in various forms depending on the type of service provided by the system, for example, public telephone network (PSTN), integrated data network (ISDN), long-distance network (WAN), local area network (LAN) ), Wireless communication network for mobile communication, and the latest direct communication network. In addition, each user terminal connected to each connection path may be a telephone, a PC, an ATM terminal, a mobile phone (cellular phone, PCS), a Bluetooth tooth terminal for one-to-one proximity wireless communication, etc. according to the aforementioned connection path. have.

The service provider system 20 includes a user authentication and service providing means 21, an existing authentication database (DB) 22, and a user authentication database (DB) 23 using a telephone network, and for each predetermined authentication step. The log level provides different services. Here, the provided services can be provided in various modified service forms, for example, Internet e-commerce service, Internet stock trading service, phone banking service, bank transaction service using an ATM terminal, Internet mud game service, Internet on-demand audio service, It may be a predetermined paid service such as an on-demand video service, a predetermined program using service, and the present invention is not limited thereto.

The existing authentication database (DB) 22 stores and manages user IDs and first passwords, and the user provides a service provider system through the first user terminal 11 and the first access path. It is used to connect to 20 to allow use of the service within a predetermined range. The telephone authentication database (DB) 23 stores and manages user IDs, telephone numbers, second passwords, and the like, and when the system requires processing outside the preset range, the user is justified. It is used to finally authenticate whether the user has rights. Here, the secondary password may be set in advance, or may be temporarily assigned by the system or user whenever the final authentication described above is required. In addition, the phone number of the user may be used as a user ID. In addition, processing outside the range set in the system means access processing to critical information or update processing of important information that should not be leaked to an unjust user out of a simple information viewing level. The information may be the resource object 40 shown in FIG. When the user authentication and service providing means 21 inputs the user's ID and the first password from the first user terminal 11 through the first access path, the user authentication and service providing means 21 and those of the corresponding user stored in the existing authentication database 22 If they compare with each other, the user's request within the preset range is processed. In addition, the user authentication and service providing means 21 transmits the telephone number of the corresponding user stored in the telephone authentication database 23 to the communication connection system (ARS) 31 when processing outside the predetermined range is required. And at the same time, control the communication connection system having the ARS processing function, and thus, the user authentication information (second password) transmitted from the communication connection system 31 in response to the second connection path and the second user terminal 12; If the second password) is compared with that stored in the telephone authentication database 23, the user finally authenticates that the user has the right and finally provides the service accordingly.

The communication connection and management system 30 basically includes a communication connection system 31 having an ARS processing function, and may further include a connection management system 32. The communication connection and management system 30 may be installed in a communication service company (for example, a general telephone base station or a mobile communication base station) located outside the service provider system 20 in the case of telecommunication, and in the case of short-range communication It may be installed inside the provider system 20. The communication connection system 31 having the ARS processing function is connected to the second user terminal 12 connected to the second access path using the telephone number transmitted from the service provider system 20 when final user authentication is required. If the user authentication information is requested by making a call, and the user authentication information is input from the second user terminal 12 through the second connection path in response, the user authentication information is transmitted to the user authentication and service providing means 21. Further, the connection management system 32 connected to the communication connection system 31 and / or the user authentication and service providing means 21 is a means for checking the user's connection details for end-user authentication and service use. Usage history related to the telephone number for which end user authentication is performed (for example, telephone number, unique number of the second user terminal 12, input frequency, connection time, secondary password of wrong user input) and / or predetermined By storing and managing the user authentication details related to the use of the paid service as a database, the charges related to tracking and / or the use of the paid service when illegal users copy the second user terminal 12 illegally and perform user authentication. Use as information.

In addition, the user authentication system according to the present invention operates in an application layer, which is the highest layer among network protocols, and uses any layered protocol (TCP / IP, OSI, SNA, DNA, etc.) used in all communication between each part. It works on any other encryption layer (SSL, PCT, Cerberus, etc.) and virtual private network services (VPN). In addition, whether or not the MULTI-TIER through the clustering, load balancing, middleware executed for the stable operation of the server, the firewall for increasing the security level that can be installed between each part on the whole system, the user authentication according to the present invention It does not affect the operation of the system.

In the user authentication system of FIG. 1 having the above-described configuration, a preferred method of performing final user authentication using the second connection path will be described with reference to FIG.

Referring to FIG. 2, first, a user operates a first user terminal 11 to access a service provider system 20 through a first connection path, and works within a preset range set in the service provider system 20. (Step 10). As in the case of Figure 1, when the existing user authentication system is more organically coupled, in step 10 the user authentication and service providing means 21 of the user input from the first user terminal 11 and the first access path The first user authentication is performed by comparing the ID and the first password thereof with those of the corresponding user stored in the existing authentication DB 22. Such primary user authentication is preferably used for user authentication to a predetermined service where security is not highly required. For example, the first user authentication is for the purpose of membership management, where the user accesses the homepage on the network to browse basic service details, or publicly known information that is not important information related to personal credit or core of paid services. Can be used to view.

If the above-described system access is primarily permitted, the user authentication and service providing means 21 determines whether final user authentication is necessary (step 20). Here, step 20 determines that the final user authentication is not necessary unless the user's request through the first access path is outside the preset allowable range in the system, so that the user can continue working within the preset allowable range. If the request corresponds to an access process or update process of important information that is outside the range set in the system, it is determined that final user authentication is required.

In step 20, if the above-described end user authentication is required, the user authentication and service providing means 21 request to temporarily input the secondary password to the first user terminal 11 via the first connection path (step 21). When the user confirms the second password arbitrarily determined in the user authentication and service providing means 21 through the first user terminal 11 and the first access path (step 22), the user authentication and service providing means 21 are provided. Temporarily stores and manages the input user's secondary password in the record of the corresponding user in the telephone authentication database 23 (step 23).

The process of initializing the secondary password consisting of steps 21 to 23 is performed by temporarily inputting and storing a secondary password arbitrarily assigned to the system through the first access path whenever a final user authentication is required. The present invention relates to an embodiment for enabling a strong level of security, and the technical features of the present invention are not limited thereto. That is, the secondary password of the user stored in the telephone authentication DB 23 for the final user authentication may be preset, may be given arbitrarily by the system and notified to the user, the second connection path and the second It may be input from the user through the user terminal 12. In addition, although the second password may be set in the same manner as the above-described first password, it is more preferable that the second password be arbitrarily assigned as the level of security requirements of the site increases. Particularly, although the second password transmitted to the system on the first access path may be encrypted based on a predetermined encryption algorithm, the end-user authentication method of the present invention does not necessarily need to perform the above encryption. Have Because the confirmation of the secondary password for the final user authentication is performed through the second user terminal 12 connected to the second access path and the corresponding phone number of the user stored in the system, even if the hacker uses the first access path. Even if it intercepts the secondary password transmitted to the system, it penetrates the service provider system 20 in which the high firewall is installed, finds the telephone number of the corresponding user, and duplicates the second user terminal 12 having the telephone number, or This is because illegal end user authentication is possible only when the second user terminal 12 having the telephone number is set.

On the other hand, if the secondary password of the user is temporarily set in the telephone authentication DB 23 according to the above-described step 21 to step 23, the user authentication and service providing means 21 is stored in the telephone authentication DB 23 The user's telephone number is read out and transmitted to the communication connection system 31 (step 24). Accordingly, the communication connection system 31 capable of ARS (voice answering system) processing dials the second user authentication terminal through the second access path and inputs the second password using the received user's phone number. (Step 25). Upon receiving the message, the user operates the second user terminal 12 to input the user's secondary password into the communication connection system 31 through the second connection path (step 26). Here, when the secondary password stored in the telephone authentication DB 23 is predetermined, the secondary password of the user is set in advance in the memory of the second user terminal 12, and the communication connection system 21 selects the secondary password. Embedding information is convenient for use. Here, the encrypted transmission of the user information (secondary password, etc.) through the second connection path is an optional and not an essential condition as in the first connection path described above.

The communication connection system 31 transmits the secondary password input from the second user terminal 12 to the user authentication and service providing means 21 via the second connection path (step 27). In addition, the connection management system 32 connected to the communication connection system 31 stores and manages the above-described communication history through the telephone number, and thus is used as basic data of charge tracking related to monitoring and tracking of illegal users. Make it. Specifically, the above-described work related to communication details and / or user authentication is monitored and recorded by the access management system 32 for recording security information. Such monitoring details include data related to the unique number, the number of times of input, the connection time, the incorrectly input secondary password, etc. of the corresponding second user terminal 12 which is automatically transmitted with the telephone number from the second user terminal 12 to the database. It can be stored so that illegal users can be tracked in case of future problems. The database is also the basis for the service provider to assign a transaction fee to the customer's telephone number, allowing the phone company to accept the price of the product in addition to the fee. Therefore, in order to use such a surrogate method, a separate access management and accounting system should be established in a telephone service provider (general telephone base station, mobile communication base station), and on a system capable of reliable connection and monitoring.

The user authentication and service providing means 21 receives the secondary password of the user who is transmitted in response to the second user terminal 12, the second connection path and the telephone connection system 31, and the first user terminal 11 and It is determined whether the second password matches the secondary password of the user temporarily stored in the first access path (step 28). As a result of this determination, if they match, the user currently connected to the system through the first access path is finally authenticated as a user having a right, and as a result, the user can confirm the service corresponding to the processing out of the predetermined range in the system. Are provided (step 29). For example, the user who has been finally authenticated by step 29 may be granted access to the resource object 40 or may update the information. Here, the resource object 40 that is allowed to access or update according to the final user authentication may be personal credit card information or a bank account, and may be important data regarding the transaction details of the product and the privacy of the individual. On the other hand, in step 28, if the secondary password answered through the second user terminal 12 does not match the secondary password temporarily stored in the system, the processing according to a separate rule or the corresponding on the system is performed. Roll back the user's existing transaction. The above-described business logic repeats steps 24 to 28 for a set number of repetitions if the secondary passwords do not coincide with each other or the time response from the second user terminal 12 exceeds a predetermined time in step 28. Can be done with

By the above steps, the user who finally obtained the second user authentication can be considered as the correct user and complete the desired work. A user who has not obtained the second authentication but only the first authentication can work, but finally This results in the inability to obtain permission to complete work on the resource.

According to the preferred embodiment of the present invention described above, the security problem in the existing user authentication system is almost completely solved. More specifically, in the existing user authentication system, when a hacker intercepts user information transmitted on a single access path and decrypts the encrypted data, it causes a large security problem inevitably requiring the illegal user to be authenticated as a legitimate user. . However, in the user authentication system using the second connection path according to the present invention, the reliability of the user authentication is improved by performing the user authentication through a different connection path than the first connection path used when using the service. Furthermore, in the user authentication system using the second access path according to the present invention, even if a hacker intercepts all the user information transmitted on both access paths, the telephone number of the legitimate user and the second user terminal 12 connected to the phone number 12 In the case of no), the final user authentication process cannot be passed, which greatly improves the security level, reliability, and stability of the user authentication system.

In addition, the second password of a legitimate user is given a different password every time a user authentication is required by the user or by the service provider system 20 arbitrarily, so that the hacker intercepts at the previous user authentication. Makes it pointless.

Another embodiment modified from the preferred embodiment according to the present invention is that the second user terminal 12 shown in FIG. 1 can be implemented as a multi-telephone-number system having at least two or more telephone numbers. Correspondingly, the plurality of telephone numbers are stored and used in the telephone authentication DB 23. Therefore, in the worst case, that is, when a user who does not have a right has a copy and owns a second user terminal 12 having a unique phone number of a user having a right, the present invention in connection with the multi-phone number system The user authentication system is equipped with the best security system by changing the second access path for end user authentication to a temporary phone number other than its own number, thereby providing a much better security effect and reliability than before. do. In this case, by assigning the unique telephone number of the second user terminal as the first connection path, it is possible to eliminate the need for a separate first user terminal.

In another modified embodiment according to the present invention, the user's red eye information or fingerprint information may be used as the user authentication information (that is, the secondary password) using the aforementioned second connection path. In this case, the second user terminal should be implemented as a terminal capable of recognizing a user's red eye or fingerprint, and corresponding authentication information should be set in the system.

Therefore, if the user authentication system according to the present invention is applied, even if the borrower's own credit card or credit card is generally loaned to others, the rightful owner of the card is the second user terminal 12 (for example, a mobile phone). By using it to confirm and complete the transaction, it provides a further effect of enabling a credit transaction at all times.

On the other hand, a number of modified embodiments that are not mentioned in the technical scope according to the spirit of the present invention will be apparent to those skilled in the art to understand the spirit of the present invention and the embodiments described above.

As described above, the user authentication system according to the present invention makes it difficult to hack and authenticate user information by a hacker by performing user authentication through a second connection path different from the first connection path used for service use. Therefore, it provides much better security effect and reliability than the existing system.

In addition, if the user authentication method of the present invention is more organically combined with the existing user authentication method, hacking is performed by performing a final user authentication using a second password different from the first password for user authentication. Minimize risks and enable reliable communication transactions. In this case, even if the hacker intercepts the first password, the second user terminal with the right owner's telephone number is set to complete the transaction, thereby providing a stronger security effect.

In addition, when the user authentication system of the present invention is used in connection with a multi-phone number system, even if a hacker duplicates a second user terminal set as a unique phone number, the user's phone number associated with the first access path set on the system is multiplied. By changing to a temporary telephone number provided by the telephone number system, the hacker can be easily disabled, thereby ensuring the stability and reliability of the user authentication system more remarkably.

Therefore, if the user authentication system according to the present invention is widely distributed and used, in the electronic commerce service using a communication network, etc., the reliability and stability of the transaction will be excellent, and the general user's anxiety will be greatly solved, thereby developing related industries. It provides more effect to promote.

Claims (6)

A user authentication system having a first connection path with a user, And process the user's request through the first connection path within a preset range, and perform user authentication using the second connection path when processing outside the preset range is requested. The method of claim 1, wherein the user authentication system When the user's ID and the first password are input through the first access path, the user's request through the first access path is processed within a predetermined range based on a result of comparing the ID and the primary password with those set in the system. If the processing out of the set range is required, the user authentication system characterized in that the user's second password is confirmed through the second connection path and finally user authentication is performed. The method of claim 1 or 2, wherein the user authentication system An authentication database for storing user IDs, telephone numbers, and user authentication passwords; Communication connection means for receiving the user authentication password from a user side communication terminal connected to the second connection path by using the user's telephone number stored in the authentication database when the user authentication is required; And Processes a request from the user terminal through the first connection path within a set range, and when processing outside the set range is required, the communication connection means is controlled to receive the authentication password from the communication connection means. And a user authentication and service providing means for performing user authentication by comparing the password with the user authentication password stored in the authentication database. The method of claim 3, wherein the user authentication and service providing means Whenever the processing out of the set range is required, first, a user authentication password is input from a user terminal connected through the first connection path, and temporarily stored in the authentication database. And receiving the authentication password from a user terminal connected to a second connection path and performing the user authentication according to a result of comparing the temporary password with the temporary password stored in the authentication database. The system of claim 3, wherein the telephone connection system is And a connection management system for recording and managing the usage history through the second connection path for tracking of charges or unjust users related to service use according to the user authentication. 4. The method of claim 3, wherein when the user-side communication terminal corresponds to a multi-telephone number system having at least two phone numbers, the first connection path and the second connection path are assigned to separate phone numbers. And operating user authentication system.